feat: add app-level authentication foundation

crates/crank-registry/src/migrations.rs

@@ -20,6 +20,7 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
             id text primary key,
             email text not null unique,
             display_name text not null,
+            password_hash text null,
             status text not null,
             created_at timestamptz not null
         )",
@@ -27,6 +28,10 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
     .execute(pool)
     .await?;
 
+    query("alter table users add column if not exists password_hash text null")
+        .execute(pool)
+        .await?;
+
     query(
         "insert into users (
             id,
@@ -58,6 +63,20 @@ pub async fn apply_postgres(pool: &PgPool) -> Result<(), sqlx::Error> {
     .execute(pool)
     .await?;
 
+    query(
+        "create table if not exists user_sessions (
+            id text primary key,
+            user_id text not null references users(id) on delete cascade,
+            secret_hash text not null,
+            status text not null,
+            expires_at timestamptz not null,
+            last_seen_at timestamptz null,
+            created_at timestamptz not null
+        )",
+    )
+    .execute(pool)
+    .await?;
+
     query(
         "insert into workspaces (
             id,